Privacy Policy

Information about the Competent Data Protection Supervisory Authority

Name: Commission for Personal Data Protection

Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Phone: 02 915 3 518

Website: www.cpdp.bg

(Hereinafter referred to as the “Controller” or the “Company”) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR). The purpose of this notice is to inform you of all aspects of the Company’s processing of your personal data and the rights you have in connection with such processing.

Legal Basis for Collecting, Processing, and Storing Your Personal Data

Art. 1. The Controller collects and processes your personal data in connection with the use of the website avftrading.com and the conclusion of contracts with the Company on the basis of Art. 6(1) of Regulation (EU) 2016/679 (GDPR), and specifically on the following grounds:

• Explicit consent obtained from you as a customer;
• Performance of the Controller’s obligations under a contract with you;
• Compliance with a legal obligation applicable to the Controller;
• For the purposes of the legitimate interests of the Controller or of a third party.

Purposes and Principles for Collecting, Processing, and Storing Your Personal Data

Art. 2. (1) We collect and process the personal data you provide to us in connection with the use of the online store and the conclusion of a contract with the Company, including for the following purposes:

• creating a profile and providing full functionality when using the online store;
• concluding and performing a distance contract;
• identifying a party to the contract;
• accounting purposes;
• statistical purposes;
• protecting information security;
• ensuring the performance of the contract for the provision of the relevant service;
• sending a newsletter, if you have expressed a wish to receive one.

(2) We observe the following principles when processing your personal data:

• lawfulness, fairness, and transparency;
• purpose limitation;
• relevance to the processing purposes and data minimization;
• accuracy and currency of data;
• storage limitation in view of achieving the purposes;
• integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

(3) When processing and storing personal data, the Controller may process and store personal data for the purpose of protecting the following legitimate interests:

• fulfilling its obligations to the National Revenue Agency, the Ministry of Interior, and other state and municipal authorities.

What Types of Personal Data Our Company Collects, Processes, and Stores

Art. 3. (1) The Company carries out the following operations with the personal data you provide, for the following purposes:

Registration of a user in the online store and performance of a distance sale contract — the purpose of this operation is to create a profile for using the online store to purchase goods and to provide contact details for the delivery of purchased goods. Registration and creation of a profile for using the online store is not a mandatory step in receiving the service and is largely accessible without creating a profile.

Conclusion from the impact assessment: Based on the impact assessment carried out, the operation “Registration of a user in the online store and performance of a distance sale contract” is permissible and provides sufficient guarantees for the protection of the rights and legitimate interests of data subjects in accordance with GDPR requirements.

Conclusion and performance of a commercial transaction with a customer or partner — the purpose of this operation is the conclusion and performance of a contract with a business partner or customer and its administration. Given the limited scope of personal data collected, and the fact that part of it is collected from publicly available sources, an impact assessment for this operation is not necessary.

Sending a newsletter — the purpose of this operation is administering the process of sending newsletters to customers who have indicated they wish to receive them. Given the limited scope of personal data collected, an impact assessment for this operation is not necessary.

Exercising the right of withdrawal or filing a complaint — the purpose of this operation is administering the process by which a customer exercises the right of withdrawal or files a complaint. Given the limited scope of personal data collected, an impact assessment for this operation is not necessary.

(2) The Controller processes the following categories of personal data and information, for the following purposes and on the following grounds:

Your identification data (email, name, etc.)

• Purpose of data collection: 1) establishing contact with the user and sending information to them, 2) for the purpose of registering a user in the online store, and 3) for sending a newsletter.
• Legal basis for processing your personal data: By accepting the general terms and conditions and registering in the online store, or placing an order without registration, or by concluding a written contract, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data — Art. 6(1)(b) GDPR. Your data for sending a newsletter is processed based on your explicit consent — Art. 6(1)(a) GDPR.

Delivery data (names, phone number, address, etc.)

• Purpose of data collection: Fulfillment of the Controller’s obligations under the sale and delivery contract for purchased goods.
• Legal basis for processing your personal data: By accepting the general terms and conditions and registering in the online store, or placing an order without registration, or by concluding a written contract, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data — Art. 6(1)(b) GDPR.

Additional data provided by you — If you wish to complete your profile, you may enter your first name, last name, and phone number.

• Purpose of data collection: Supplementing the user’s information in their user account.
• Legal basis for processing: You have given explicit consent for the processing of your personal data for one or more specific purposes — Art. 6(1)(a) GDPR — at the time of registration in the online store. Providing this data is not mandatory for registration in the online store.

(3) The Controller does not collect or process personal data that:

• reveal racial or ethnic origin;
• reveal political, religious, or philosophical beliefs, or trade union membership;
• constitute genetic or biometric data, data concerning health, or data concerning sex life or sexual orientation.

(4) Personal data is collected by the Controller from the individuals to whom it relates.

(5) The Company does not carry out automated decision-making using data.

Art. 4. (1) The Company carries out the following operations with the personal data provided by you as legal representatives or authorized agents of legal entities that are business partners, for the following purposes:

Conclusion and performance of a commercial transaction: For the conclusion and performance of a commercial transaction with a company, we process only the full name of the legal representative or the person authorized by the company.

Conclusion from the impact assessment: Given the small number of individuals whose data is processed, and the limited scope of personal data collected, an impact assessment for this operation is not necessary.

(2) Personal data is collected by the Controller from the individuals to whom it relates and from the Commercial Register at the Registry Agency.

(3) The Company does not carry out automated decision-making using data.

Art. 5. The Controller may use so-called “cookies” for the purposes of providing full website functionality, improving the user experience, statistical purposes, ease of access, and similar, to which you consent by using our website. You may control and/or delete “cookies” at any time through your browser settings. “Cookies” do not constitute personal data and are not used to identify visitors and users of the online store.

Retention Period for Your Personal Data

Art. 6. (1) The Controller stores your personal data for a period no longer than the existence of your profile in the online store. After your profile is deleted, the Controller takes the necessary steps to delete and destroy all your data without undue delay, or to anonymize it (i.e., render it in a form that no longer identifies you).

(2) The Controller processes the personal data you provided when placing an order without registration in the online store until the order is completed, unless you have given your explicit consent, at the time of placing the order, for your data to be processed for the purposes of improving the service, providing recommended content for you, individual terms, promotions, and statistical purposes.

(3) The Controller stores your personal data provided in connection with online orders for a period of 5 years, for the purpose of protecting the Controller’s legal interests in the event of judicial or administrative disputes with users of the online store.

(4) The Controller will notify you if the data retention period needs to be extended in view of the fulfillment of a statutory obligation, the Controller’s legitimate interests, or other grounds.

(5) The Controller stores personal data that it is required to keep under applicable legislation for the relevant statutory period, which may exceed the duration of your profile’s existence in the online store or the completion of your order.

Art. 7. The Controller stores the personal data of the legal representatives of its business partners for the duration of the contract’s performance, in order to comply with the Controller’s legitimate interests and statutory obligations; this period may exceed the term of the concluded contract.

Transfer of Your Personal Data for Processing

Art. 8. (1) The Controller may, at its own discretion, transfer part or all of your personal data to data processors for the fulfillment of the processing purposes to which you have agreed, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Controller will notify you if it intends to transfer part or all of your personal data to third countries or international organizations.

Your Rights Regarding the Collection, Processing, and Storage of Your Personal Data

Withdrawal of Consent to Data Processing

Art. 9. (1) If you do not wish your provided personal data to be processed for marketing purposes and receiving a newsletter, you may withdraw your consent to processing at any time by completing the consent withdrawal form in Appendix 1, or by making a request in free text, and sending it to us by email.

(2) Upon receiving your request, we will send you, at the email address you provided for receiving newsletters and promotional messages, a letter with detailed instructions for verifying you as a recipient of newsletters and as the data subject for whom consent withdrawal has been requested.

(3) Withdrawal of consent does not affect the lawfulness of processing carried out by the Controller prior to the withdrawal.

Right of Access

Art. 10. (1) You have the right to request and receive confirmation from the Controller as to whether personal data relating to you is being processed, by sending a request in free text by email.

(2) You have the right to access the data relating to you, as well as information concerning the collection, processing, and storage of your personal data.

(3) Upon receiving your request, we will send you, at the email address you used for registration or for placing orders in the online store, a letter with detailed instructions for verifying you as the data subject to whom the requested access relates.

(4) After verification under para. 3, upon request, the Controller will provide you with a copy of the personal data being processed about you, in electronic or other suitable form.

(5) Access to the data is provided free of charge; however, the Controller reserves the right to charge an administrative fee in the case of repeated or excessive requests.

Right to Rectification or Completion

Art. 11. (1) You may at any time correct or complete inaccurate or incomplete personal data relating to you through the “Edit profile” option.

(2) You may correct or complete inaccurate or incomplete personal data relating to you directly through your profile on the website, or by submitting a request to the Controller by email, using the form in Appendix 4 or by making a request in free text.

Right to Erasure (“the Right to Be Forgotten”)

Art. 12. (1) You have the right to request that the Controller erase part or all of the personal data relating to you, and the Controller is obliged to erase it without undue delay when one of the following grounds applies:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw the consent on which the processing is based, and there is no other legal ground for the processing;
• you object to the processing of your personal data, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
• the personal data has been processed unlawfully;
• the personal data must be erased for compliance with a legal obligation under EU law or the law of a Member State applicable to the Controller;
• the personal data has been collected in connection with the offer of information society services.

(2) The Controller is not obliged to erase the personal data if it stores and processes it:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation requiring processing, provided for by EU law or the law of the Member State applicable to the Controller, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the Controller;
• for reasons of public interest in the area of public health;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
• for the establishment, exercise, or defense of legal claims.

(3) To exercise your right to be forgotten, you need to send a request by email for the erasure of your personal data processed by the Controller, by completing the form in Appendix 2 or by making a request in free text, after which the Controller will send you, at the email address you used for registration or for placing orders in the online store, a letter with detailed instructions for verifying you as a user of the store and as the data subject for whom erasure has been requested.

(4) After we have verified the identity of the person submitting the request and the person to whom the data relates, in accordance with the instructions sent to you, we will erase all data we process about you, in accordance with para. 3.

(5) If you have placed an order that is being processed, the earliest point at which you may request to be “forgotten” is upon successful completion of the order.

Right to Restriction

Art. 13. You have the right to request that the Controller restrict the processing of data relating to you, by sending us a request in free text by email, when:

• you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
• the processing is unlawful, but you do not wish the personal data to be erased, and instead request restriction of its use;
• the Controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims;
• you have objected to the processing pending verification as to whether the Controller’s legitimate grounds override your interests.

(2) Upon receiving your request, we will send you, at the email address you used for registration or for placing orders in the online store, a letter with detailed instructions for verifying you as a user of the store and as the data subject for whom restriction of processing has been requested.

(3) After verification under para. 2, the Company will suspend the processing of your data, but will not remove any posts you have made in the online store, if any.

Right to Data Portability

Art. 14. (1) If you have given consent to the processing of your personal data, or if processing is necessary for the performance of the contract with the Controller, or if your data is processed by automated means, you may:

• request that the Controller provide you with your personal data in a readable format for transfer to another controller;
• request that the Controller transfer your personal data directly to a controller specified by you, where this is technically feasible.

(2) You may exercise the right to data portability by sending us, by email, the completed form in Appendix 3 or a request in free text, after which the Controller will send you, at the email address you used for registration or for placing orders in the online store, a letter with detailed instructions for verifying you as a user of the store and as the data subject for whom portability has been requested.

(3) After verification under para. 2, the Company will send the data it processes about you, in XML format, to the email address you specified.

Right to Receive Information

Art. 15. You may request that the Controller inform you of all recipients to whom the personal data for which rectification, erasure, or restriction of processing has been requested has been disclosed. The Controller may refuse to provide this information if doing so would prove impossible or would require disproportionate effort.

Right to Object

Art. 16. You may object at any time to the processing of personal data relating to you by the Controller, including where such data is processed for profiling or direct marketing purposes.

Your Rights in the Event of a Personal Data Security Breach

Art. 17. (1) If the Controller identifies a breach of the security of your personal data that may pose a high risk to your rights and freedoms, it will notify you without undue delay of the breach and of the measures taken or to be taken.

(2) The Controller is not obliged to notify you if:

• it has implemented appropriate technical and organizational protection measures with respect to the data affected by the security breach;
• it has subsequently taken measures ensuring that the breach is unlikely to result in a high risk to your rights;
• notification would require disproportionate effort.

Recipients of Your Personal Data

Art. 18. (1) For the purposes of processing your personal data and providing the service in its full functionality, and having regard to your interests, the Controller may provide the data to the following data processors:

(2) Data processors comply with all legal and security requirements when processing and storing your personal data.

Art. 19. The Controller does not transfer your data to third countries.

Art. 20. In the event of a violation of your rights under the above or under applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection

Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Phone: 02 915 3 518

Website: www.cpdp.bg

Art. 21. You may exercise all your rights regarding the protection of your personal data using the forms attached to this notice. These forms are, of course, not mandatory, and you may submit your requests in any form that contains a statement to this effect and identifies you as the data subject.

Art. 22. If consent relates to a data transfer, the Controller will describe the possible risks of transferring data to third countries in the absence of an adequacy decision and appropriate safeguards.

Appendix 1 — Consent Withdrawal Form

Your name*: …………………….

Your email used in the online store*: …………………….

Contact details (email)*: …………………….

To

Name: …………………….

Company registration number: …………………….

Registered office and management address: …………………….

Correspondence address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

I hereby withdraw my consent to the processing of the personal data I have provided for the purposes of receiving a newsletter, promotional messages, or other marketing materials, having familiarized myself with the terms of consent withdrawal in accordance with the Mandatory Information on Data Subjects’ Rights Regarding Personal Data Protection of the online store.

In the event of a violation of your rights under the above or under applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection

Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Phone: 02 915 3 518

Website: www.cpdp.bg

Appendix 2 — Request to Be Forgotten (Erasure of Personal Data)

Your name*: …………………….

Your email used for registration or orders in the online store*: …………………….

Contact details (email)*: …………………….

To

Name: …………………….

Company registration number: …………………….

Registered office and management address: …………………….

Correspondence address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

Please erase from your databases all personal data that you collect, process, and store, provided by me or by third parties related to me, in accordance with the above identification.

I declare that I am aware that part or all of my personal data may continue to be processed and stored by the Controller for the purpose of fulfilling its statutory obligations.

In the event of a violation of your rights under the above or under applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection

Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Phone: 02 915 3 518

Website: www.cpdp.bg

Appendix 3 — Request for Data Portability

Your name*: …………………….

Your email used for registration or orders in the online store*: …………………….

Contact details (email)*: …………………….

To

Name: …………………….

Company registration number: …………………….

Registered office and management address: …………………….

Correspondence address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

Please send all personal data relating to me, collected, processed, and stored in your databases, in XML format to:

Email: …………………….

Receiving Controller:

Name: …………………….

Identification number (company registration, VAT, CPDP registration number): …………………….

Email: …………………….

In the event of a violation of your rights under the above or under applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection

Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Phone: 02 915 3 518

Website: www.cpdp.bg

Appendix 4 — Request for Data Rectification

Your name*: …………………….

Your email used for registration or orders in the online store*: …………………….

Contact details (email)*: …………………….

To

Name: …………………….

Company registration number: …………………….

Registered office and management address: …………………….

Correspondence address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

Please correct the following personal data, collected, processed, and stored by you, provided by me or by third parties related to me, as follows:

Data to be corrected:

…………………………………………..

Please correct it as follows:

…………………………………………..

In the event of a violation of your rights under the above or under applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection

Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

Phone: 02 915 3 518

Website: www.cpdp.bg